Quantum resistance
isn’t a checkbox.

Shor’s algorithm is the catastrophe. It breaks elliptic-curve and discrete-log cryptography outright — not “weakens,” breaks. Every ECDSA signature, every RSA key, every classical Diffie-Hellman exchange falls.

Grover’s algorithm is survivable. Against hash functions it offers only a quadratic speedup — effectively halving the security level. A 256-bit hash drops to 128 bits, still far beyond reach.

So the rule for the rest of this page: anything resting on elliptic curves dies; anything resting on hashes survives.

✅ post-quantum · ◐ weakened but safe · ✗ classical, Shor-vulnerable.

The threat isn’t a quantum computer existing someday. It’s harvest-now, decrypt-later. An adversary need only record the chain today — every exposed public key, every ciphertext — and wait. When a cryptographically-relevant quantum computer arrives, they decrypt and forge retroactively.

On a value-bearing chain this still bites the transparent base layer: exposed classical signature keys can be forged to move funds. But shielded notes are encrypted with a post-quantum KEM, so a recorded shielded ciphertext holds nothing a future quantum computer can unmask.

The problem every chain will hit. A quantum computer running Shor’s algorithm breaks the elliptic-curve signatures (ECDSA) that guard nearly every coin in existence. The obvious fix is to swap them for a post-quantum signature — but a lattice signature like ML-DSA runs ~3,300 bytes to ECDSA’s ~72, and once it’s wrapped into a full spend that’s ~24× the size of an ordinary transaction — on every transaction. That isn’t a tweak; it’s a throughput collapse. So most projects either wave at quantum as a someday-problem or quietly accept that going post-quantum guts their capacity. Stealth is built so it doesn’t have to make that trade.

Two rails, neither pays the cliff. Stealth has a private rail (XSS) and a transparent rail (XST), and each handles quantum a different way — the right way for what it is.

The private rail is post-quantum by construction — today. Shielded payments aren’t authorized by a signature at all. They’re authorized by a zk-STARK — a proof whose only cryptographic assumption is a collision-resistant hash. Shor’s algorithm has nothing to attack; the best a quantum computer manages against a hash is Grover’s algorithm, which merely halves the security margin, and the parameters already carry that headroom. There is no key for a quantum computer to forge. (Confidentiality — the encryption of a note’s contents — uses a post-quantum key exchange too, so there is no harvest-now-decrypt-later window.) This rail sustains tens of private transactions per second, measured, today.

The transparent rail is fast today — and hardens without a cliff. Transparent XST uses ECDSA, and yes, Shor’s algorithm breaks ECDSA. We don’t hide that. But the answer isn’t a giant post-quantum signature bloating every spend. It’s commit-reveal: before you spend, you publish a small sealed commitment that pins exactly where the coins are going — while your public key is still secret, so it exposes nothing a quantum computer can use. Then you make the ordinary spend, keeping its normal ~72-byte signature. Even a quantum attacker who cracks your key from that spend can’t redirect the coins — the destination was locked in before the key was ever revealed. No giant signature, no 24×. And because the threat is still years away and uncertain, the mechanism stays dormant until quantum is genuinely a risk — so it costs nothing today, and switches on only if and when it’s needed.

What that costs — measured, not promised. Transparent XST runs at hundreds of transactions per second today. When commit-reveal is switched on, each payment becomes a two-step spend, which roughly halves payment throughput — still hundreds per second, a hardening step rather than a collapse — and the private rail is untouched. Every throughput figure we publish is measured, not a whitepaper estimate.

The result is a choice, not a forced migration. Every classical coin faces a do-or-die quantum deadline: the entire supply is signed with breakable keys, and going post-quantum means migrating all of it at once, with the whole supply exposed during the switch. Stealth gives you a post-quantum haven built in — the private rail is quantum-safe now — plus in-place protection for transparent coins when the time comes. Post-quantum safety here is a choice you make coin by coin, and the chain stays fast either way.